Malicious Pull Requests targeting the Vizor and Zingo wallets were not merged; the campaign combined credential-stealing code with instructions attempting to trick AI code reviewers into not flagging the upload of secrets.